Vibe-Coded App Spec Drift Audit

• **Prelint**: GitHub/GitLab PR-level product review grounded in specs, ADRs, documentation, and business constraints. It costs $1/review and is free for open-source repositories. Its product, price, and workflow are direct and strong; it owns continuous PR review.
• **RTMify / Trace.Space / RequirementMatrix / test-management suites**: requirements traceability, test evidence, impact analysis, and compliance reporting for mature or regulated teams. They validate budget while raising the credibility and feature threshold.
• **Vibe-code repository auditors / production-readiness checklists**: security, architecture, performance, and launch advice delivered as free prompts, static checkers, or consulting. They compete for the same community attention.
• **GitHub Copilot / Greptile / CodeRabbit and other code-review tools**: focus on correctness, security, or code quality and can naturally expand into product intent, creating platform-substitution risk.
• Defensible wedge: serve builders without mature PR/CI workflows who are preparing a first launch or client handoff. One submission of PRD + repository + live URL produces a reviewable requirements matrix and launch-blocker evidence. A continuous PR bot competes directly with Prelint; a generic score competes with free checklists.
• SERP occupancy: accessible results already include RTM products, vibe-coding checklists, community audits, and mature code-review category pages. Google Top 3/Top 10, AI Overview, geography, and device have not been measured. DataForSEO and reproducible SERP checks are required before SEO expansion.

8h MVP Checklist

1. 1.Create two fixture repositories and PRDs plus a human gold matrix; define `covered/partial/missing/conflicting/unable` precisely.
2. 2.Implement safe repository/PRD intake, file manifest, exclusion rules, and token/cost estimation.
3. 3.Implement structured requirement extraction and the user-confirmation step.
4. 4.Implement repository evidence retrieval, deterministic citation validation, and coverage classification.
5. 5.Build the result matrix, top blockers, remediation prompts, and Markdown/CSV export.
6. 6.Add the sample report, home, FAQ, About, Privacy, and `$49` Payment Link.
7. 7.Add error recovery, upload security, API cost caps, Vitest/Playwright coverage, and a clean Vercel build.
8. 8.Human-review three to five real public or authorized projects; launch only once material false findings are at or below 20%.
9. 9.Reach ten target projects and record completion, checkout, and payment. Pageviews do not substitute for commercial validation.

Don't Build

• ✕Do not expand features without approval.
• ✕Do not add complex backend infrastructure unless real analysis requires it.
• ✕Do not start with custom auth, memberships, order management, subscription billing, or an admin console; keep the lightweight Payment Link test.
• ✕Do not sacrifice launch speed for cosmetic completeness.
• ✕**Do not remove the core workflow to make the build “lightweight.”**
• ✕Do not build a generic code-quality, security, or production score; remain focused on PRD specification consistency.
• ✕Do not claim implementation without evidence and do not output compliance certification or a 100%-production-ready verdict.
• ✕Do not persist private source code or send secrets/environment files to the model.